Hirecraft Privacy Policy

1. Introduction

Hirecraft Inc. ("Hirecraft", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our websites (including hirecraft.ai), use our applicant‑tracking and recruiting software‑as‑a‑service platform (the "Services"), or otherwise interact with us.

If you do not agree with this Privacy Policy, please do not access or use our Services. By using Hirecraft, you acknowledge that you have read and understood this Policy.

2. Scope

This Policy applies to:

• Employers, recruiters, and hiring managers who create an account on Hirecraft.
• Student and graduate candidates who apply to roles managed through Hirecraft.
• Visitors to our marketing sites and landing pages.

This Policy does not apply to third‑party websites or services that we do not own or control—even if they are linked from our Services.

3. Information We Collect

4. How We Use Information

We use information to:

1. Provide the Services - create accounts, process log‑ins, parse resumes, compute candidate fit scores, and display dashboards.
2. Facilitate hiring workflows - share candidate information with authorized employer users.
3. Improve and personalize - train models, run analytics, and develop new features.
4. Communicate - send transactional emails (e.g., invitations, status updates) and product‑related announcements.
5. Protect - detect fraud, enforce terms, and secure our infrastructure.
6. Comply with legal obligations - tax, accounting, and regulatory requirements.

Where required by law (e.g., GDPR), our legal bases include contract performance, legitimate interests, consent, and legal obligation.

5. Cookies & Similar Technologies

We use:

• Essential cookies (authentication, session management)
• Analytics cookies (page usage statistics via self‑hosted Plausible)
• Local storage (user preferences)

You can control cookies via your browser settings. Disabling cookies may impact site functionality.

6. How We Share Information

We share information only as necessary:

• Within Hirecraft - between authorized personnel who need access to operate the Service.
• Service Providers - cloud infrastructure, payment processing, email delivery, and analytic vendors bound by contractual confidentiality and data‑processing agreements.
• Employers & Candidates - candidate data is visible to the hiring organization that created or is managing the job posting.
• Legal & Safety - if required by law, subpoena, or to protect rights, property, or safety of Hirecraft, our users, or the public.
• Business Transfers - in connection with a merger, acquisition, or asset sale (you will be notified ahead of any change in ownership or use of your data).

We never sell personal information for advertising or marketing purposes.

7. International Data Transfers

We host data in 🇨🇦 Canada and the 🇺🇸 United States. If you are located outside these regions, your information may be transferred, stored, and processed in jurisdictions with different data‑protection laws. We rely on Standard Contractual Clauses or other permitted safeguards for cross‑border transfers.

8. Security

We employ administrative, technical, and physical security measures, including:

• Encryption in transit (TLS 1.2+) and at rest (AES‑256)
• Role‑based access controls and principle of least privilege
• Regular security testing (SAST, dependency scanning, penetration tests)
• SOC 2 compliant policies in progress

No system is 100% secure; we cannot guarantee absolute security, but we strive to protect your information.

9. Data Retention

We retain personal data only as long as necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law (e.g., tax, accounting, legal requirements). Employers can delete candidate data at any time via the dashboard. Candidate data is automatically purged 24 months after application closure unless the employer opts in to extended alumni tracking.

10. Your Rights & Choices

Depending on your location, you may have rights under GDPR (EEA/UK), PIPEDA & Quebec Law 25 (Canada), CPRA (California), or other laws, including the right to:

• Access or obtain a copy of your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

You can exercise these rights by emailing privacy@hirecraft.ai. We will respond within 30 days.

11. Children's Privacy

Hirecraft is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date and post the new version on our website. Material changes will be communicated via email or in‑app notice at least 30 days before they take effect.

13. Contact Us

If you have questions about this Policy or our privacy practices, please contact: